nxc_wmi · Sec Netexec MCP: Risk & Policy

WHAT IT DOES

What nxc_wmi does on Sec Netexec

AI agents invoke nxc_wmi to trigger actions in Sec Netexec. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why nxc_wmi needs a policy

This tool executes arbitrary commands on remote Windows systems via WMI protocol. WMI allows for remote code execution and system management tasks. Given that this is explicitly a penetration testing framework command executor with access to credential-based remote command execution, misuse could result in unauthorized remote code execution on Windows systems, lateral movement, and complete system compromise.

From the tool's definition Tool description states 'Execute NetExec WMI protocol commands' and server description indicates 'execute NetExec network penetration testing commands via SSH'. WMI (Windows Management Instrumentation) enables remote command execution on Windows systems.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

nxc_wmi Rate-limited

nxc_wmi stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "nxc_wmi": {
      "limits": [
        {
          "counter": "nxc_wmi_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Sec Netexec, so you can run agents against it safely.

FAQ

Questions about nxc_wmi

What does the nxc_wmi tool do? +

Execute NetExec WMI protocol commands for Windows management and command execution. It is categorised as a Execute tool in the Sec Netexec MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on nxc_wmi? +

Register the Sec Netexec MCP server in PolicyLayer and add a rule for nxc_wmi: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Sec Netexec. Nothing to install.

What risk level is nxc_wmi? +

nxc_wmi is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit nxc_wmi? +

Yes. Add a rate_limit block to the nxc_wmi rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block nxc_wmi completely? +

Set action: deny in the PolicyLayer policy for nxc_wmi. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides nxc_wmi? +

nxc_wmi is provided by the Sec Netexec MCP server (schwarztim/sec-netexec-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.